CVE-2024-24860

Published: 5 February 2024

A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.

From the Ubuntu Security Team

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash).

Notes

Priority reason:
Requires write access to debugfs entries, which are restricted to root by default on Ubuntu kernels.

fix commit references 18f81241b74f ("Bluetooth: Move
{min,max}_key_size debugfs ...")  but the race condition looks to
have existed since the introduction of le_min_key_size_write()
and le_max_key_size_write() which were later renamed to
{min,max}_key_size_set().

Status

Severity score breakdown

References

• https://ubuntu.com/security/notices/USN-6688-1
• https://ubuntu.com/security/notices/USN-6725-1
• https://www.cve.org/CVERecord?id=CVE-2024-24860
• https://ubuntu.com/security/notices/USN-6725-2
• https://ubuntu.com/security/notices/USN-6765-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.suse.com/show_bug.cgi?id=1219608
• https://bugzilla.openanolis.cn/show_bug.cgi?id=8151